220-1202 Practice Test 2 — 25 Questions

Question 1

A technician is performing a routine software update on a finance department server. The change management documentation specifies that the update must be applied during a maintenance window from 2:00 AM to 4:00 AM. At 3:30 AM, the update fails with an error. The technician has no rollback plan documented. What should the technician do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Leave the server in its current state and escalate the issue to the change manager.. The technician has no documented rollback plan, and the change management process requires that any deviation from the approved plan—such as a failed update—must be escalated to the change manager for a decision. Attempting an undocumented rollback or continuing to troubleshoot without authorization risks data corruption, service disruption, or violating compliance policies. The technician’s primary duty is to preserve the server’s current state and follow the escalation path defined in the change management policy.

Answer

Attempt to roll back the update using the server’s built-in recovery options.

Answer

Continue troubleshooting until the maintenance window ends, then document the failure.

Answer

Reboot the server to clear the error and retry the update.

Question 2

During a security audit, you discover that a Windows 10 workstation has the 'Store passwords and credentials using reversible encryption' policy enabled. What is the primary security risk associated with this setting?

Accepted Answer

It stores passwords in a format that can be easily decrypted, making them vulnerable if the database is compromised.. The 'Store passwords using reversible encryption' policy causes Windows to store passwords in a format that can be decrypted back to plaintext. This directly violates the principle of storing only hashed credentials; if the SAM database or LSASS process memory is compromised, an attacker can recover the original password, enabling lateral movement or privilege escalation.

Answer

It increases the time required to log on to the system.

Answer

It allows users to bypass the password complexity requirement.

Answer

It prevents the use of biometric authentication methods.

Question 3

A user reports that their iPhone's battery drains quickly and the phone feels warm. After checking, you find that several apps are using Location Services in the background. What is the most efficient way to manage this without disabling location for all apps?

Accepted Answer

Set each app's location permission to 'While Using the App'. Setting each app's location permission to 'While Using the App' is the most efficient solution because it prevents apps from accessing location services in the background, which is the primary cause of battery drain and heat generation. This granular control allows critical apps (e.g., Maps) to still function when actively used, while stopping unnecessary background location polling that consumes GPS and cellular resources.

Answer

Turn off Location Services entirely in Privacy settings

Answer

Enable Low Power Mode

Answer

Reset all settings on the iPhone

Question 4

A small business owner wants to ensure that only authorized USB storage devices can be used on company laptops running Windows 10 Pro. They have a list of approved device hardware IDs. Which security policy should be configured to enforce this restriction?

Accepted Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions. The 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions allows an administrator to specify a whitelist of approved hardware IDs. When configured, only USB storage devices whose hardware IDs match the list will be installed, effectively blocking all unauthorized devices. This directly enforces the requirement to restrict USB storage to approved devices only.

Answer

Enable the 'Removable Storage Access' policy under Windows Components

Answer

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Answer

Set the 'Deny all devices' policy under Device Installation Restrictions

Question 5

A user reports that they cannot access a shared folder on the network, but other users can. The folder is on a Windows 10 Pro workstation. What should you check first to resolve this issue?

Accepted Answer

Check the NTFS permissions on the folder. Since other users can access the shared folder, the network share and firewall are functioning correctly. The issue is specific to one user, which points to a permission problem at the file system level. NTFS permissions control user-level access to folders, and a misconfigured or missing ACE (Access Control Entry) for that user would prevent access while allowing others. Checking NTFS permissions is the logical first step because it directly governs per-user access to the resource.

Answer

Check the Windows Defender Firewall settings

Answer

Check the user’s password expiration status

Answer

Check the User Account Control settings

Question 6

A client brings in a laptop that was used by an employee who left the company. The manager wants to ensure all data is unrecoverable before recycling the laptop. The laptop has a traditional HDD. Which method should be used?

Accepted Answer

Run a full overwrite using disk-wiping software.. Disk-wiping software performs a full overwrite of every sector on the HDD with patterns (e.g., zeros, random data), making the original data unrecoverable even with advanced forensic tools. This method is specifically designed for secure data destruction on functional drives, ensuring compliance with data sanitization standards like NIST SP 800-88.

Answer

Perform a quick format of the drive.

Answer

Use a degausser to demagnetize the drive.

Answer

Physically shred the drive with a hard drive shredder.

Question 7

A user reports that they can no longer connect to the company network from home using VPN. They confirm their internet connection is working and that they can browse websites. Which of the following should a technician check first to resolve the VPN connectivity issue?

Accepted Answer

Verify the user's VPN username and password. The user's internet connection is working (they can browse websites), which rules out general network connectivity issues. The most common cause of VPN authentication failure is incorrect or expired credentials, so verifying the username and password is the quickest and most logical first step before escalating to more complex troubleshooting.

Answer

Check if the VPN client software is up to date

Answer

Restart the VPN server at the data center

Answer

Reinstall the network adapter drivers

Question 8

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. To audit access attempts to a specific folder, you must enable the 'Audit object access' policy in the Advanced Audit Policy Configuration (or the legacy 'Audit object access' under Local Policies). This policy alone does not audit anything; you must also configure a System Access Control List (SACL) on the 'Confidential' folder itself, specifying which access types (e.g., Read, Write) for which users or groups to audit for success and failure. Without the SACL, no object access events are generated.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 9

A user complains that their Remote Desktop session to a Windows 10 Pro workstation frequently disconnects after a few minutes of inactivity. The workstation is on a local network. Which setting should the technician modify on the host computer to prevent this?

Accepted Answer

Increase the idle session limit in Remote Desktop settings. The Remote Desktop Session Host (RDSH) has a configurable idle session limit that disconnects sessions after a period of inactivity. By default, Windows 10 Pro may enforce a short idle timeout (often 1-5 minutes) to conserve resources. Increasing this limit in the Remote Desktop Session Host settings (under Local Group Policy or the Remote Desktop Services configuration) prevents the automatic disconnection the user is experiencing.

Answer

Disable the screensaver

Answer

Change the power plan to High Performance

Answer

Enable Network Level Authentication

Question 10

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.

Question 11

A user reports that their MacBook Pro running macOS Ventura is unable to open any applications after a recent system update. They see a spinning beach ball when clicking app icons. Which macOS tool should you use first to diagnose and resolve this issue?

Accepted Answer

Activity Monitor. Activity Monitor is the correct first tool because it allows you to inspect running processes, CPU usage, memory pressure, and disk activity. The spinning beach ball indicates a hung or unresponsive process, likely caused by a kernel extension or system daemon failing after the update. Activity Monitor can identify the offending process (e.g., a high CPU or stuck I/O process) so you can force quit it or gather logs for further troubleshooting.

Answer

Terminal

Answer

Disk Utility

Answer

System Information

Question 12

A user reports that a specific application crashes immediately on launch. You want to verify the integrity of the application's core files without reinstalling. Which command-line tool can you use to scan and repair system files that the application depends on?

Accepted Answer

sfc /scannow. The `sfc /scannow` (System File Checker) command scans all protected system files and replaces corrupted versions with a cached copy located in the `%WinDir%\System32\dllcache` directory. Since the application crashes on launch, it likely depends on core Windows system files (e.g., DLLs, executables) that may be corrupted or missing. Running `sfc /scannow` verifies and repairs these system files without reinstalling the application itself, directly addressing the integrity of the dependencies.

Answer

chkdsk /f

Answer

tasklist

Answer

dism /online /cleanup-image /restorehealth

Question 13

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 14

A technician is configuring a new Windows 10 kiosk computer that will run a single application for public use. They need to prevent users from accessing the desktop, taskbar, or other system functions. Which Windows security feature should be used?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) is the correct feature because it locks down the Windows 10 device to run only a single Universal Windows Platform (UWP) app or a classic Win32 app in full-screen mode, completely hiding the desktop, taskbar, Start menu, and other system interfaces. This is specifically designed for public-facing kiosk scenarios where users must not be able to exit the application or access any other system functions.

Answer

User Account Control (UAC) set to highest level

Answer

Local Group Policy – Software Restriction Policies

Answer

Windows Defender Application Guard

Question 15

A user calls the help desk saying they cannot access a shared folder on the network. They can access other shares on the same server. The technician verifies the user's account is active and the folder exists. What should the technician check next to resolve the access issue?

Accepted Answer

Review the NTFS permissions on the shared folder.. Since the user can access other shares on the same server, the issue is isolated to a specific shared folder. NTFS permissions control access at the folder level independently of share permissions, and a missing or incorrect NTFS entry for the user would block access even if the share permissions are open. The technician should review the NTFS permissions on that folder to ensure the user or their group has at least Read access.

Answer

Check if the user's password has expired.

Answer

Verify the user has been added to the local Administrators group.

Answer

Reboot the file server to clear any cached permissions.

Question 16

A user wants to share a folder on their Windows 11 PC so that other users on the local network can access files without a password. They have already enabled network discovery and file sharing. Which additional setting must they configure in the Advanced Sharing settings to allow password-less access?

Accepted Answer

Turn off password protected sharing. To allow password-less access to shared folders on a local network, you must disable password protected sharing. When this setting is turned off, Windows 11 does not require users to have a local account and password on the host machine; instead, it grants access based on the 'Everyone' group permissions. This is configured in the 'Advanced sharing settings' under 'All Networks'.

Answer

Turn on Public folder sharing

Answer

Enable 128-bit encryption

Answer

Set up a homegroup

Question 17

A technician is cleaning the inside of a desktop computer that has accumulated a large amount of dust. What is the safest method to remove the dust?

Accepted Answer

Use compressed air to blow the dust out of the case.. Compressed air is the safest method because it dislodges dust without physical contact, avoiding electrostatic discharge (ESD) or mechanical damage to sensitive components. Unlike other methods, it does not introduce moisture or static buildup, and it can reach tight spaces between heatsinks and circuit boards.

Answer

Use a standard household vacuum cleaner with a brush attachment.

Answer

Use a damp cloth to wipe down the components.

Answer

Use a soft brush to sweep the dust out.

Question 18

During a routine security audit, you find that an employee has taped their door lock open to avoid using their badge every time they leave for a break. What is the most immediate security concern with this practice?

Accepted Answer

Unauthorized persons can enter without credentials. Propping a door lock open bypasses the physical access control system (PACS), allowing anyone—including unauthorized individuals—to enter the secured area without presenting valid credentials (e.g., a proximity card or PIN). This directly defeats the purpose of the access control mechanism, which is to authenticate and log each entry. The most immediate risk is that an attacker or tailgater can gain unrestricted physical access to sensitive assets, systems, or data.

Answer

The employee might lose their badge

Answer

It violates company badge policy

Answer

The door lock may break from being forced open

Question 19

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to 'suspicious activity.' The email address looks legitimate, but the link points to a different domain. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email uses social engineering to trick the user into clicking a link that leads to a fraudulent domain, even though the sender's address appears legitimate. Phishing is a broad category of social engineering where attackers impersonate a trusted entity to steal credentials or sensitive information, and the mismatched link is the key indicator.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 20

A security incident occurred where an attacker modified a PowerShell script on a file server to include malicious commands. The script is executed daily by a scheduled task. Which scripting security best practice could have prevented this attack?

Accepted Answer

Use a digital signature to sign the script and enforce execution policy. Enforcing an execution policy that requires scripts to be digitally signed ensures that only scripts signed by a trusted publisher can run. If the attacker modified the script, the digital signature would become invalid, and the execution policy would block the script from running, preventing the malicious commands from executing.

Answer

Store the script in a hidden folder

Answer

Set the script file to read-only

Answer

Compile the script into an executable